www.paypal.co.uk.gdby.ru
Open in
urlscan Pro
194.116.163.24
Malicious Activity!
Public Scan
Effective URL: https://www.paypal.co.uk.gdby.ru/l/Tax-Refund.php?sslchannel=true&sessionid=Q76xZWUgmis3O3SoL1ojZ31lVmgQjhI3x9IYsmIuwdJmWF6HodKar...
Submission: On July 09 via api from TW
Summary
TLS certificate: Issued by Let's Encrypt Authority X3 on July 6th 2020. Valid for: 3 months.
This is the only time www.paypal.co.uk.gdby.ru was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: UK Government (Government)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
1 7 | 194.116.163.24 194.116.163.24 | 202423 (MGNHOST-AS) (MGNHOST-AS) | |
1 | 2a00:1450:400... 2a00:1450:4001:81b::200a | 15169 (GOOGLE) (GOOGLE) | |
9 | 3 |
Apex Domain Subdomains |
Transfer | |
---|---|---|
7 |
gdby.ru
1 redirects
www.paypal.co.uk.gdby.ru |
29 KB |
1 |
googleapis.com
ajax.googleapis.com |
33 KB |
0 |
jqueryvalidation.org
Failed
jqueryvalidation.org Failed |
|
0 |
jsdelivr.net
Failed
cdn.jsdelivr.net Failed |
|
9 | 4 |
Domain | Requested by | |
---|---|---|
7 | www.paypal.co.uk.gdby.ru |
1 redirects
www.paypal.co.uk.gdby.ru
|
1 | ajax.googleapis.com |
www.paypal.co.uk.gdby.ru
|
0 | jqueryvalidation.org Failed |
www.paypal.co.uk.gdby.ru
|
0 | cdn.jsdelivr.net Failed |
www.paypal.co.uk.gdby.ru
|
9 | 4 |
This site contains no links.
Subject Issuer | Validity | Valid | |
---|---|---|---|
paypal.co.uk.gdby.ru Let's Encrypt Authority X3 |
2020-07-06 - 2020-10-04 |
3 months | crt.sh |
upload.video.google.com GTS CA 1O1 |
2020-06-17 - 2020-09-09 |
3 months | crt.sh |
This page contains 1 frames:
Primary Page:
https://www.paypal.co.uk.gdby.ru/l/Tax-Refund.php?sslchannel=true&sessionid=Q76xZWUgmis3O3SoL1ojZ31lVmgQjhI3x9IYsmIuwdJmWF6HodKaroi0VJKFAh4xXcYiV9aXMzT0l9Ix
Frame ID: 194E278CB618834A6539323C15928E0C
Requests: 9 HTTP requests in this frame
Screenshot
Page URL History Show full URLs
-
http://www.paypal.co.uk.gdby.ru/l/
HTTP 301
https://www.paypal.co.uk.gdby.ru/l/ Page URL
- https://www.paypal.co.uk.gdby.ru/l/Tax-Refund.php?sslchannel=true&sessionid=Q76xZWUgmis3O3SoL1ojZ31lVmgQjhI3x... Page URL
Detected technologies
Nginx (Web Servers) ExpandDetected patterns
- headers server /nginx(?:\/([\d.]+))?/i
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
-
http://www.paypal.co.uk.gdby.ru/l/
HTTP 301
https://www.paypal.co.uk.gdby.ru/l/ Page URL
- https://www.paypal.co.uk.gdby.ru/l/Tax-Refund.php?sslchannel=true&sessionid=Q76xZWUgmis3O3SoL1ojZ31lVmgQjhI3x9IYsmIuwdJmWF6HodKaroi0VJKFAh4xXcYiV9aXMzT0l9Ix Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
Request Chain 0- http://www.paypal.co.uk.gdby.ru/l/ HTTP 301
- https://www.paypal.co.uk.gdby.ru/l/
9 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H/1.1 |
Cookie set
/
www.paypal.co.uk.gdby.ru/l/ Redirect Chain
|
209 B 572 B |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
Primary Request
Tax-Refund.php
www.paypal.co.uk.gdby.ru/l/ |
21 KB 5 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
main.css
www.paypal.co.uk.gdby.ru/l/assets/styles/ |
46 KB 12 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
jquery.min.js
ajax.googleapis.com/ajax/libs/jquery/1.8.3/ |
91 KB 33 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
jquery.payment.js
www.paypal.co.uk.gdby.ru/l/assets/js/ |
17 KB 4 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
logo.png
www.paypal.co.uk.gdby.ru/l/assets/img/ |
7 KB 7 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
help.gif
www.paypal.co.uk.gdby.ru/l/assets/img/ |
149 B 384 B |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET |
jquery.validate.js
cdn.jsdelivr.net/jquery.validation/1.14.0/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||||
GET |
additional-methods.min.js
jqueryvalidation.org/files/dist/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||||
Failed requests
These URLs were requested, but there was no response received. You will also see them in the list above.
- Domain
- cdn.jsdelivr.net
- URL
- http://cdn.jsdelivr.net/jquery.validation/1.14.0/jquery.validate.js
- Domain
- jqueryvalidation.org
- URL
- http://jqueryvalidation.org/files/dist/additional-methods.min.js
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: UK Government (Government)4 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
function| $ function| jQuery function| movetoNext function| populate1 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
www.paypal.co.uk.gdby.ru/ | Name: PHPSESSID Value: j3mli5m2mat1u2vvqcf76nmo0r |
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
ajax.googleapis.com
cdn.jsdelivr.net
jqueryvalidation.org
www.paypal.co.uk.gdby.ru
cdn.jsdelivr.net
jqueryvalidation.org
194.116.163.24
2a00:1450:4001:81b::200a
190b90b1f62ad6798fca4c93adce6d0205c13b960b609af306f2d87b54885f85
3abea1f134122debe08b7340f97da964d55430ec57d1707c88def041103c93a2
61c6caebd23921741fb5ffe6603f16634fca9840c2bf56ac8201e9264d6daccf
62287ec5f7a5a98b46b0fb11ee8159b9f9f0e034a74c4ae2a3d6f79122081a09
7e58a516021e0a0951cf6eddcd621d895fe317509baa0239867d4d75a68f74e4
82cb37877a47fdc5ce49603dc05229b4094f02f5bd510d5a05bff55f53dfed0a
b072c44bfab6dbc45edf4cc19cedf2ae1ec20678d80a25ab29d1cc24063aab64